New Abe Office Malware Bypasses Chrome App-Bound Encryption to Steal Browser Passwords and Cookies
Abe Office malware bypasses Chrome's encryption to steal passwords and cookies.
A new remote-access trojan named Abe Office has been discovered that can steal browser passwords and cookies by bypassing Chrome's App-Bound Encryption. The malware, disguised as an office helper tool, uses a valid code-signing certificate and weak protections that researchers were able to break. It operates by creating a hidden desktop and injecting a helper DLL into browsers to trick the elevation service into decrypting sensitive data.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Abe Office malware succeeds by masquerading as a legitimate office productivity tool, complete with a valid code-signing certificate, exploiting the trust users and security tools place in signed software. By injecting a helper DLL into the browser process and abusing Chrome's App-Bound Encryption elevation service, it silently decrypts and exfiltrates stored passwords and cookies without triggering obvious alerts. This matters because browser-stored credentials and session cookies are high-value targets that grant attackers immediate authenticated access to corporate and personal accounts. The attack chain highlights how social engineering (disguising malware as useful software) combined with technical evasion can bypass even modern browser security mechanisms. Organizations relying solely on endpoint detection without behavioral monitoring or user training are especially vulnerable.
What helps against this
How we list vendors
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Abe Office
- malware — AbeAgent.exe